
GPAI
AI Act category for powerful AI models deployed across many applications, covering systems like GPT-4 and Gemini.
Last refreshed: 17 May 2026
Which AI models count as systemic-risk GPAI and what extra obligations do they face?
Timeline for GPAI
France chairs G7 Digital Ministerial on 29 May
European Tech SovereigntyAI Omnibus deal splits enforcement into two speeds
European Tech Sovereignty- What is GPAI under the EU AI Act?
- GPAI (general-purpose AI) is the EU AI Act category for large AI models like GPT-4, Gemini, or Mistral that can perform many tasks across different domains. The AI Act imposes reporting and testing obligations on GPAI providers, with stricter rules for models that exceed a certain training compute threshold and are considered to pose systemic risk.Source: EUR-Lex
- Does the EU AI Act apply to ChatGPT and Google Gemini?
- Yes. GPT-4/o and Gemini are likely classified as systemic-risk GPAI models under the EU AI Act, requiring OpenAI and Google to conduct mandatory adversarial testing, report incidents to the EU AI Office, and implement cybersecurity measures.
- Why does Mistral AI get lighter rules under the EU AI Act?
- Mistral's models are released as open-weight models, meaning the model weights are freely available for download and modification. The AI Act gives open-weight GPAI models reduced obligations compared to closed commercial models, a concession France negotiated to protect European open-source AI development.
Background
General-purpose AI (GPAI) is the regulatory category established in Title VIII of the EU AI Act (Regulation 2024/1689) to govern AI models trained on large amounts of data that can perform a wide Variety of tasks across domains — including large language models (LLMs), image generation models, and multimodal systems. Unlike narrow AI systems designed for a specific purpose, GPAI models are integrated into downstream applications by third parties, creating complex liability and oversight questions. The AI Act distinguishes standard GPAI models from those posing systemic risk — defined as models with training compute exceeding 10^25 FLOPs — which face enhanced obligations including mandatory adversarial testing, incident reporting to the AI Office, and cybersecurity measures .
The GPAI provisions were among the most contested elements of the AI Act negotiations. Providers of high-impact GPAI models include OpenAI (GPT-4/o), Google (Gemini), Anthropic (Claude), Meta (Llama), and European providers like Mistral AI (Mistral Large). France successfully negotiated protections for open-weight models like Llama and Mistral, with lighter obligations for models that make weights freely available. The AI Office, established within the Commission, is the primary enforcement body for GPAI at EU level, with national authorities handling downstream application compliance.
For European tech sovereignty, GPAI is the regulatory lens through which the EU asserts jurisdiction over the frontier AI race. The 2026 AI Omnibus deal split enforcement timelines, applying earlier compliance dates to GPAI providers than to European companies deploying AI in applications, giving EU-headquartered deployers longer to adapt while keeping the clock running on US frontier model providers. Finnish MEP Aura Salla was controversially appointed rapporteur for the GPAI delegated acts, drawing criticism from Corporate Europe Observatory and EU Observer.